Description
An issue was discovered in the HTTP FileResponse class in Django 3.2 before 3.2.15 and 4.0 before 4.0.7. An application is vulnerable to a reflected file download (RFD) attack that sets the Content-Disposition header of a FileResponse when the filename is derived from user-supplied input.
Remediation
References
Related Vulnerabilities
phpList Cross-Site Request Forgery (CSRF) Vulnerability (CVE-2014-2916)
ownCloud Permissions, Privileges, and Access Controls Vulnerability (CVE-2013-2047)
WordPress Plugin Shopping Cart & eCommerce Store Information Disclosure (2.0.5)
PHP Numeric Errors Vulnerability (CVE-2011-0755)
WordPress Plugin Motors-Car Dealer & Classified Ads Multiple Vulnerabilities (1.4.0)